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About this Opinion 


What is the status of this Opinion? 


The Data Protection Act 2018 (DPA 2018), specifically S115(3)(b), allows 
the Information Commissioner (the Commissioner) to issue Opinions to 
government, other institutions or bodies as well as the public, on any 
issue related to the protection of personal data. 


The Commissioner can issue Opinions on his own initiative or on request. 


This Opinion sets out the reasoning behind the Commissioner’s decision 
that ‘public task’ is the correct lawful basis on which the DVLA should 
process vehicle keeper data, when sharing it with car park management 
companies to recover unpaid parking charges. 


Who is the Opinion for? 


This Opinion is primarily for the DVLA and the Department for Transport. 
They are the data controllers for this processing. It may also be of 
interest to people who complained to the Commissioner about the DVLA 
disclosing their personal data to private car parking companies to recover 
unpaid parking charges. It may help them in understanding what his 
decision means for them. It may also be of interest to those relying on 
Schedule 4 of the Protection of Freedoms Act 2012 (POFA). This is the 
statutory scheme for the Recovery of Unpaid Parking Charges, who may 
have questions about the practical impact of his decision on the continued 
integrity of the scheme. 


The Opinion complements the outcome of the complaints investigated 
under S165 of the DPA 2018. It also draws on evidence that the DVLA 
provided. 


What is the background to this issue? 


Following the DPA 2018 coming into force, the DVLA sought advice from 
the Information Commissioner’s Office (ICO). They wanted to know the 
correct lawful basis under Article 6(1) of the UK GDPR for sharing the 
personal data of vehicle keepers with car park management companies to 
recover fines. At the time, the DVLA were relying on legal obligation as 
their lawful basis to process this data. Regulation 27(1)(e) of the Road 
Vehicle (Registration and Licensing) Regulations 2002 allows the DVLA to 
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release keeper information to anyone who can demonstrate reasonable 
cause for wanting this information. The DVLA therefore thought that 
Regulation 27(1)(e) provided them with a legal duty to share those 
details with car park management companies to recover fines. They 
believed this satisfied the requirement under Article 6(1)(c) of the UK 
GDPR that the processing is necessary for compliance with a ‘legal 
obligation’. 


The Commissioner received a number of complaints from people, about 
both the application of Regulation 27(1)(e) and the DVLA’s sharing of 
vehicle keeper data more generally. It is important to be clear that the 
Commissioner’s remit is focused on the protection of personal data. It is 
not his role to oversee DVLA’s wider role in the parking enforcement 
system. His role is to determine the correct lawful basis for the DVLA to 
share this information. Where appropriate and proportionate, his role is 
also to ensure people’s rights are protected under data protection law. 


What is the Commissioner’s finding? 


Following consideration of the evidence and legal analysis, the 
Commissioner concluded that the DVLA’s correct lawful basis is public 
task, not legal obligation. This is because Regulation 27(1)(e) provides 
the DVLA with a power, rather than a legal duty, to disclose vehicle 
keeper information to car park management companies in these 
circumstances. In order to rely on legal obligation, the DVLA would need 
to demonstrate that the processing was necessary for compliance with a 
‘legal obligation’. This would require the DVLA to have a legal duty to rely 
on, which in our view Regulation 27(1)(e) does not provide. 


It is important to note that in coming to this conclusion, the 
Commissioner does not doubt that car park management companies have 
reasonable cause to request keeper information from the DVLA in these 
circumstances, and that the DVLA is generally required to provide it. 
However, Regulation 27(1)(e) creates a power rather than a duty as there 
is a discretion for the DVLA to refuse a request for keeper information in 
exceptional cases. For example, if the keeper was on a national security 
protection list. This applies even if the requestor has demonstrated 
reasonable cause. Public task is the correct legal basis in these 
circumstances, because Regulation 27(1)(e) creates a task (a power, 
rather than a legal duty) to be carried out in the public interest (hence 
the reasonable cause requirement). Disclosing vehicle keeper data is 
necessary for this task. 
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If the DVLA breached the DPA 2018, why is the 
Commissioner not taking enforcement action? 


The Commissioner regards this as a technical infringement of the law. The 
situation apparently arose because of an unintended change to the 
interaction between the Parking Regulations and data protection law, 
following the 2018 data protection law reforms. The Commissioner does 
not doubt the DVLA’s policy of reasonable cause. He also does not dispute 
that the DVLA has a power to disclose this information to car park 
management companies to recover fines. The Commissioner's role was to 
determine the correct lawful basis for doing this. 


Having done this, the Commissioner is not under any obligation to take 
formal enforcement action, even where an organisation’s conduct may 
infringe data protection legislation. He can choose how best to enforce the 
laws he oversees. The relevant factors for exercising his discretion are 
based on: 


e whether it is in the public interest to do so; 


e the degree of harm to UK people caused by the processing of 
personal data; and 


e the economic impact of any regulatory interventions. 


Taking these factors into account, the Commissioner concluded that using 
the ICO’s resources to pursue enforcement action in this case would not 
be in the public interest. This is because the risk of harm to vehicle 
keepers from the DVLA disclosing their information under the legal 
obligation lawful basis rather than public task is very low. 


The Commissioner considers that the most appropriate way forward is for 
the government to review the relevant legislation. They should look to 
address the interaction between different pieces of legislation to provide 
legal certainty on the correct approach. If the Department for Transport 
and the DVLA believe that Regulation 27(1) gives the DVLA a legal duty 
rather than a power to share keeper information, the government might 
choose to consider a legislative remedy that puts this issue beyond doubt. 
This would provide certainty to both the DVLA and to vehicle keepers. 
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Can people who are, or are potentially, subject to unpaid 
parking charges exercise their right to object under the 
UK GDPR when their data is being processed under the 
public task lawful basis? 


The right to object under the UK GDPR has a built-in exception, where the 
organisation is processing the information ‘for the establishment, exercise 
or defence of legal claims’. 


Paragraph 11 of Schedule 4 of POFA contains an enforceable legal right of 
the car park management company to claim the charges from the vehicle 
keeper. It is not for the DVLA to determine the validity of claims against 
the vehicle keeper. Car park management companies can use the 
exception. It would be for a court or parking tribunal to determine the 
validity of any claim. It is the Commissioner's view is that the DVLA could 
refuse an Article 21(1) objection by the vehicle keeper in these 
circumstances. 


Does the Commissioner’s decision mean the DVLA 
should not have shared vehicle keeper information with 
car park management companies? 


No. Regulation 27(1)(e) provides the DVLA with a power to disclose 
vehicle keeper information with car park management companies to 
recover fines. In addition, Paragraph 11 of Schedule 4 provides car park 
management companies with an enforceable legal right to claim charges 
from vehicle keepers. The question under consideration, therefore, was 
not whether the DVLA had a lawful basis to disclose vehicle keeper 
information; they did. Rather, the Commissioner’s decision was about 
whether ‘legal obligation’ was the correct lawful basis for doing this. 


Does the Commissioner’s decision mean existing 
parking fines issued after the DVLA shared vehicle 
keeper information are invalid? 


No. The Commissioner determined that the DVLA was not using the 
correct lawful basis to disclose vehicle keeper information. This does not 
mean that no lawful basis existed. Regulation 27(1)(e) provides the DVLA 
with the power to do this, using the public task lawful basis. In addition, 
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paragraph 11 of Schedule 4 of POFA provides car park management 
companies with an enforceable legal right to claim charges from vehicle 
keepers. It is not for either the DVLA or the Commissioner to determine 
the validity of past parking fines. This is a matter for the courts or parking 
tribunal. 


Are the DVLA required to inform vehicle keepers of their 
intention to disclose their information to car park 
management companies to recover unpaid parking 
charges? 


No. There is no provision in either the UK GDPR or Regulation 27(1)(e) 
that requires the DVLA to inform vehicle keepers of this. However, 
Schedule 4 of POFA tells vehicle keepers that their information may be 
requested to recover unpaid charges. 


